MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 991a9408b15bec9a534018b66b5f6df88378ce97978e126eefb1ac4838a360cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


AgentTesla


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 991a9408b15bec9a534018b66b5f6df88378ce97978e126eefb1ac4838a360cd
SHA3-384 hash: aed5af70f02ab6b103a9afb5dcc594f4c06faf4469268eac363551b40bebcb857e2683f4cff189caffbaa902d26dc6af
SHA1 hash: dce826d85f520cddb9e9193c08ad0cb16a4925a3
MD5 hash: 20c7f9f627953822329995435ed44e31
humanhash: march-burger-sink-mirror
File name:Bank Account details.rar
Download: download sample
Signature AgentTesla
Create hunting rule
File size:609'879 bytes
First seen:2020-08-14 15:39:21 UTC
Last seen:Never
File type: rar
MIME type:application/x-rar
ssdeep 12288:eTV6yTF+TC0EOXPur7+zpuAE5fOox5J0MjXWj+DvPFmjuCzrZgv:eTEyTFkLC7bAUfBPJ0MKj8mjfzryv
TLSH CBD4333F07DCD936E593858AE41EC7A41BB730AB4F5A7F0456A06900905B9E33B8E35E
Reporter abuse_ch
Tags:AgentTesla rar


Avatar
abuse_ch
Malspam distributing AgentTesla:

HELO: properso.com
Sending IP: 62.210.157.138
From: Mahmoud Nasr <mahmoud.nasr@cibeg.com>
Subject: payment details
Attachment: Bank Account details.rar (contains "Bank Account details.exe")

AgentTesla SMTP exfil server:
mail.tejoofashions.com:587

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/991a9408b15bec9a534018b66b5f6df88378ce97978e126eefb1ac4838a360cd/
Threat name:
ByteCode-MSIL.Trojan.Kryptik
Create hunting rule
Status:
Malicious
First seen:
2020-08-14 15:41:05 UTC
AV detection:
14 of 48 (29.17%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=tenjicfrlpwjuu2adc3gwx3n7cbxrtuxs6hbe3xpwgweqofdmdgq._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/991a9408b15bec9a534018b66b5f6df88378ce97978e126eefb1ac4838a360cd

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

AgentTesla

rar 991a9408b15bec9a534018b66b5f6df88378ce97978e126eefb1ac4838a360cd

(this sample)

AgentTesla

Executable exe 4363d2320266f58ce9011c5ed32b16429156d92762ed01843f57eb02bd71aa22

  
Dropping
MD5 64231b9e4dae263a4b0d5c46afe46bc1
  
Dropping
AgentTesla
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 4363d2320266f58ce9011c5ed32b16429156d92762ed01843f57eb02bd71aa22

Comments